Privacy Policy · WildOn

Effective 2 August 2026. This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you use the WildOn app, the WildOn website, WildOn cameras and related devices, and any connected services (together, the “Service”).

WildOn is owned and operated by Buynetic Pty Ltd (ABN 46 647 898 468, ACN 647 898 468), an Australian private company based in New South Wales, Australia (“Buynetic”, “we”, “us”, “our”). Buynetic is the entity responsible for your personal information under this policy — the “data controller” for the purposes of the EU and UK General Data Protection Regulation, and an “APP entity” for the purposes of the Australian Privacy Act 1988 (Cth). More about the company at www.buynetic.com.au.

1. Summary — the short version

What we collect. Your account details, the photos and videos your cameras capture, where those cameras are, information about your cameras and their SIMs, your subscription and payment status, your support messages, and technical logs about how the Service is used.
Why. To run the Service you signed up for: delivering your captures to your phone, keeping your cameras connected, billing your plan, supporting you, keeping accounts secure, and improving the product.
We do not sell your personal information, and we do not share it with advertisers or data brokers for cross-context behavioural advertising.
Your captures are yours. We do not make them public. They are visible to you and to anyone you deliberately share them with.
You are in control. You can access, correct, export and delete your data, including deleting your entire account from inside the app at any time (see section 13).
Third parties. We use a small set of named service providers — payment, cloud storage, messaging, mapping, AI processing and mobile connectivity — listed in full in section 8.

2. Who this policy applies to and what it covers

This policy applies to:

the WildOn mobile applications for iOS and Android;
the WildOn web application at app.wildon.com.au and our public websites;
WildOn cameras and other WildOn-supplied devices, and the cellular connectivity supplied with them; and
our support, billing and account services.

It applies to account holders, people invited to view or share content, people who contact our support team, and visitors to our websites. Section 12 deals separately with people and property that may appear in images captured by a WildOn camera.

This policy does not cover third-party services you choose to use alongside WildOn, such as your app store, your email provider, or a social network you post your captures to. Their own privacy policies apply to those services.

3. Information we collect

3.1 Account and profile information

Your first and last name, email address, and (if you choose to add one) a profile photo.
Your password, stored only as a salted one-way cryptographic hash — we never store or have access to your plaintext password.
Your time zone, display and unit preferences, map style, and view preferences.
Optional contact details you add, such as a mobile number used for one-time codes or notifications.
Two-factor authentication settings and recovery state.
Your account status, roles, and permission history.

3.2 Information from social sign-in

If you sign in with Google or with Apple, we receive from that provider a stable user identifier, your email address, and (on the first authorisation only, and only if you allow it) your name. If you use Apple’s Hide My Email feature, we receive a private relay address rather than your real one, and that is what we use to contact you. We do not receive your Google or Apple password, and we do not receive contacts, calendars, files or any other data from those accounts.

3.3 Camera, device and connectivity information

Device identifiers supplied at setup or read from the device: serial number, barcode number, IMEI, model, hardware revision and firmware version.
SIM identifiers and cellular details, including ICCID, carrier, signal strength and network registration status.
Operational telemetry reported by the camera: battery level, storage state, temperature, wake and trigger events, capture settings, and connection and upload history.
Commands you or we send to a camera (for example, a request for a high-resolution copy, a settings change, or a firmware update) and the camera’s responses.
Cellular data consumption per camera and per SIM, used to meter your plan and to show you your usage.

3.4 Captures — photos and videos

The photos and videos your cameras capture and upload, in standard and high resolution, together with their thumbnails and preview frames.
Capture metadata: date and time, camera, trigger type, temperature, battery and signal at time of capture, and the file’s technical properties.
Information derived from the capture by our AI features, such as detected species, object counts and quality scores, and any tags or corrections you apply yourself.
Notes, titles, trip groupings, favourites and other organisational information you add.

3.5 Location information

Camera location. The position of each camera, either reported by the camera’s own GPS receiver or set by you on the map. This can be precise to within a few metres. Camera location is used to place captures on your map, to group them into trips, and to help you find your cameras.
Capture location. The camera position recorded against each capture.
Your device’s location. The WildOn mobile app requests location permission only for features that need it — for example, centring the map on you, or setting a camera’s position from where you are standing. You can decline, and you can revoke the permission in your operating system settings at any time; the rest of the Service continues to work. We do not track your phone’s location in the background, and we do not build location profiles about you.
Approximate location from network. Your IP address gives a coarse, city-level indication of where a request came from. We use it for security, fraud prevention and regional routing.

3.6 Subscription and payment information

Your plan, add-ons, subscription status, renewal dates, trial status and billing history.
Invoices, receipts and credits.
Billing contact details and, where applicable, billing address and tax information.

We do not store your full card number. Card details are collected by and sent directly to our payment processor, Stripe, which is certified to PCI DSS Level 1. We retain only a payment token and non-sensitive descriptors such as card brand, last four digits and expiry month, so you can recognise your own payment method. If you subscribe through the Apple App Store or Google Play, that store processes the payment and we receive only the transaction and subscription status, never your card details.

3.7 Sharing, groups and social features

Friend connections, groups you create or join, and invitations you send or receive.
Share links you create, their settings and expiry, and aggregate view counts.
Camera or content transfers between accounts, including the request and its outcome.

3.8 Support and communications

Support tickets, messages, in-app chat, and any screenshots, logs or files you attach.
Emails and SMS messages we exchange with you, and delivery and open status for transactional email.
Your notification preferences and push notification tokens.

3.9 Technical and log information

IP address, browser and browser version, operating system, device type and app version.
Session records: sign-in and sign-out times, session identifiers, device labels and approximate location, so you can review and revoke your own sessions.
Security and audit events: sign-in attempts, password and email changes, permission changes, administrative actions, and rate-limiting events.
Diagnostic logs and error reports generated when something goes wrong.
Requests to our API, including the endpoint, timestamp, response status and client identifier.

3.10 Cookies and similar technologies

We use a small number of cookies and equivalent browser storage:

Strictly necessary — session and authentication cookies that keep you signed in and protect against cross-site request forgery. The Service does not function without these.
Preference — storage of your interface choices, such as theme, units and list-versus-grid view.
Security — Cloudflare Turnstile, which we use in place of an intrusive CAPTCHA to distinguish humans from automated abuse on sign-in.
Analytics — Google Analytics 4 on our web surfaces, which tells us in aggregate which pages are used and where people encounter problems. We do not use it for advertising, we do not enable Google Signals or ad personalisation, and we do not sell or share the data it produces.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics using Google’s browser add-on. Blocking strictly necessary cookies will prevent you from signing in. The WildOn mobile apps do not use third-party advertising identifiers and do not track you across other companies’ apps or websites.

3.11 Information we do not collect

We do not knowingly collect sensitive information as defined by the Privacy Act 1988 (Cth) or special-category data under the GDPR — such as health, biometric, racial or ethnic, political, religious, union-membership, sexual-orientation or criminal-record information. Please do not send it to us. We do not use facial recognition, and our AI features are trained and used to identify wildlife and objects, not to identify individual people. We do not collect information from your phone’s contacts, calendar, microphone, call logs or SMS inbox, and we do not read your device’s photo library except for images you deliberately select to upload (for example, a profile photo or a support attachment).

4. How we collect information

Directly from you — when you create an account, set up a camera, subscribe, contact support, or fill in anything in the app.
From your cameras and SIMs — automatically, when a camera connects to our servers to upload a capture or report its status.
Automatically from your browser or app — technical and log information as described above.
From third parties — from Google or Apple if you use social sign-in; from Stripe or an app store in relation to your subscription; from our mobile connectivity providers in relation to your SIM; and from another WildOn user if they invite you, share content with you, or transfer a camera to you.

5. Why we use your information, and our lawful bases

We use personal information for the following purposes. For users in the European Economic Area and the United Kingdom, the lawful basis for each purpose is noted in brackets.

Providing the Service — creating and maintaining your account, receiving and storing captures, keeping your cameras connected, delivering content to your devices, and operating the app. (Performance of a contract.)
Cameras and connectivity — provisioning and managing SIMs, metering data, sending commands and firmware updates, and diagnosing device faults. (Performance of a contract.)
AI features — analysing your captures to detect and tag species, count animals, generate enhanced imagery and improve capture quality. (Performance of a contract, where the feature is part of your plan; consent where you opt in to an optional AI feature.)
Billing — processing subscriptions, add-ons and one-off purchases, issuing invoices and receipts, handling failed payments, refunds and chargebacks. (Performance of a contract; legal obligation for tax and accounting records.)
Notifications — sending push, email and SMS messages about captures, camera health, plan status, security events and service changes. (Performance of a contract; legitimate interests; consent where required for marketing.)
Support — answering your questions, reproducing and fixing faults, and keeping a record of what was resolved. (Performance of a contract; legitimate interests.)
Security, integrity and fraud prevention — authenticating you, detecting and blocking abuse, protecting accounts and devices, rate-limiting, and investigating incidents. (Legitimate interests; legal obligation.)
Improving the Service — understanding in aggregate which features are used, diagnosing performance problems, and planning capacity and new features. (Legitimate interests.)
Legal and regulatory compliance — meeting our obligations under Australian and other applicable law, responding to lawful requests, and establishing, exercising or defending legal claims. (Legal obligation; legitimate interests.)
Marketing — telling you about new WildOn features, products and offers, where you have not opted out. Every marketing message includes an unsubscribe link, and unsubscribing never affects the service messages you need to run your cameras. (Consent, or legitimate interests where permitted, consistent with the Spam Act 2003 (Cth).)

Where we rely on legitimate interests, we have considered the effect on you and have concluded that our interest does not override your rights. You can object to that processing at any time — see section 13.

6. Automated processing and AI

WildOn uses machine learning to make your captures more useful. When a capture arrives, it may be analysed automatically to detect wildlife, propose species labels and counts, assess image quality, and generate an enhanced version. Some of this analysis runs on our own infrastructure and some is performed by our AI processor, OpenAI, acting under contract on our instructions.

You should understand that:

AI output is a suggestion, not a fact. Species identifications, counts and other labels can be wrong, and you can correct them yourself in the app.
Our AI processing is directed at wildlife, objects and image quality. We do not use it to identify, profile or score individual people.
We do not permit our AI processor to use your captures or prompts to train its own general-purpose models.
We may use de-identified or aggregated data — data from which you and any individual cannot reasonably be identified — to evaluate and improve our own detection models. If we ever wanted to use your identifiable captures to train a model, we would ask for your consent first.
No decision that produces a legal or similarly significant effect on you is made solely by automated means. Account suspensions and similar decisions involve human review.

7. When we disclose information

We disclose personal information only in the circumstances described here. We do not sell personal information, and we do not disclose it to third parties for their own marketing.

To people you choose. When you share a capture, a trip, a camera or a share link, the content and the information you chose to attach to it become visible to those recipients. If you transfer a camera to another account, information necessary to complete the transfer is disclosed to the recipient.
To our service providers. The named providers listed in section 8, each acting under contract, only on our instructions, and only to the extent needed to perform their function.
To your mobile network operator. Where necessary to provision, activate, suspend or troubleshoot the SIM in your camera.
For legal reasons. Where we are required or authorised by law to disclose information, including in response to a subpoena, court order, warrant or other lawful request by a public authority; to enforce our Terms & Conditions; or where we reasonably believe disclosure is necessary to prevent serious and imminent harm to a person, to prevent or investigate a crime, or to protect our rights, property or safety. We assess every request, require it to be lawful and specific, and will notify you unless we are legally prohibited from doing so.
In a business transaction. If Buynetic is involved in a merger, acquisition, restructure or sale of assets, personal information may be disclosed to the counterparty and its advisers, subject to confidentiality. If the Service changes hands, we will tell you before your personal information becomes subject to a different privacy policy.
To professional advisers. Our auditors, lawyers, insurers and accountants, where they need it and under a duty of confidentiality.

8. Our service providers

We keep this list short and specific. Each of these providers processes personal information on our behalf, under contractual terms that require appropriate security and restrict them to our instructions.

Stripe — payment processing, subscriptions, invoices and receipts. Receives your billing details and card data directly. (United States, Australia, Ireland.)
Apple — Sign in with Apple, Apple Push Notification service, and App Store subscription processing for purchases made on iOS. (United States and elsewhere.)
Google — Google Sign-In; Firebase Cloud Messaging for Android push notifications; Google Maps for map display and geocoding; Google Analytics 4 for aggregate web analytics; and Google Play subscription processing for purchases made on Android. (United States and elsewhere.)
Expo — delivery of push notifications to the WildOn mobile apps. (United States.)
Wasabi Technologies — encrypted object storage for your photos and videos. (Regional data centres; see section 9.)
Cloudflare — content delivery, DNS, DDoS protection and the Turnstile human-verification challenge. (Global edge network.)
Twilio SendGrid — delivery of transactional and notification email. (United States.)
Twilio — delivery of SMS messages, such as one-time verification codes. (United States.)
OpenAI — AI analysis of captures, as described in section 6, under an API agreement that prohibits training on our data. (United States.)
OVH and our infrastructure providers — hosting of the WildOn application servers and databases. (Australia and Europe.)
Mobile connectivity providers — including Simplex Wireless and Simetric, which provision and manage the SIMs and cellular data used by WildOn cameras, together with the underlying mobile network operators. (Australia and internationally.)

We review this list as our infrastructure changes, and we will update it here. Sub-processors are engaged under written terms that meet the requirements of the Australian Privacy Principles and, where relevant, Article 28 of the GDPR.

9. Overseas storage and international transfers

WildOn is operated from Australia. Some of the providers listed above store or process personal information outside Australia, principally in the United States, the European Union, the United Kingdom and Singapore.

Before disclosing personal information overseas, we take reasonable steps under Australian Privacy Principle 8 to ensure the recipient handles it consistently with the Australian Privacy Principles. For transfers of personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with the additional technical and organisational safeguards described in section 10.

You may ask us at support@wildon.com.au for more detail about the safeguards applying to a particular transfer.

10. How we protect your information

All traffic between your devices, your cameras and our servers is encrypted in transit using TLS. Data stored in our databases and object storage is encrypted at rest.
Passwords are stored only as salted one-way hashes using a modern, deliberately slow hashing algorithm.
Access to production systems is restricted to a small number of authorised personnel, requires multi-factor authentication and a private network connection, and is logged.
Photos and videos are served through short-lived, signed URLs that expire, rather than from publicly listable storage.
We apply the principle of least privilege at the database level, isolate services from one another, rate-limit our public interfaces, and keep an audit trail of administrative and security-relevant actions.
We monitor for unusual activity, patch our systems, and periodically review our security controls.

No system is perfectly secure. You play an essential part: use a strong, unique password, turn on two-factor authentication, keep your devices updated, review your active sessions, and tell us immediately at support@wildon.com.au if you think your account has been compromised.

Data breaches. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and where the GDPR applies we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

11. How long we keep information

We keep personal information only as long as we need it for the purposes described in this policy, or as long as the law requires.

Account information — for as long as your account is open.
Captures — until you delete them, or until your plan’s retention limit is reached. Deleted captures are removed from your view immediately and purged from our storage, including backups, within 90 days.
Camera and connectivity records — for the life of the camera on your account, plus up to 12 months for fault diagnosis and data-usage disputes.
Billing and tax records — seven years after the transaction, as required by Australian taxation law.
Support tickets — three years after the ticket is closed.
Security and audit logs — up to 24 months.
Technical and diagnostic logs — typically 30 to 90 days.
Marketing suppression records — indefinitely, because we need to remember that you unsubscribed.

When you ask us to delete your account, we start a 14-day grace period during which the account is closed and signed out but not yet erased. You can cancel the deletion during that period by signing back in. At the end of it, deletion runs automatically and cannot be reversed: we delete or irreversibly de-identify your personal information, and complete the process within 30 days of your request. The exceptions are records we are legally required to keep (principally billing and tax records) and any content that has become part of another user’s account, such as a camera you transferred to someone else.

12. People and property captured by cameras

WildOn cameras are outdoor wildlife cameras that trigger on motion. It is possible for a person, a vehicle or a neighbouring property to appear in a capture even though that was not your intention.

If you own or operate a WildOn camera, you are the person responsible for how and where it is used, and for complying with the laws that apply to you. Depending on where you are, that may include surveillance-device and listening-device legislation, workplace surveillance law, trespass and property law, hunting and wildlife regulation, and privacy law. In broad terms:

Place cameras only on land you own or have the landholder’s permission to use.
Do not point a camera at a place where a person would reasonably expect privacy, such as a dwelling, a bathroom, a change room, or a neighbour’s yard.
Do not use WildOn to monitor, follow or record a specific person, whether or not they know about it.
Where the law requires notice or consent for recording, obtain it.

Buynetic processes captures on your behalf. If you are an individual using WildOn for your own private and domestic purposes, you generally act as the controller of those images and we act as your processor. If you are using WildOn for a business or organisational purpose, you are responsible for your own privacy compliance in relation to any person who appears in a capture.

If you believe you appear in a WildOn capture and want to know what we hold or ask for its deletion, contact us at support@wildon.com.au. We will need enough information to locate the material — roughly where and when it was recorded — and we will handle your request, or refer it to the responsible camera owner, within 30 days.

13. Your rights and choices

You can exercise all of the following without charge, and we will not treat you differently for doing so.

13.1 In the app

Access and correct — view and edit your profile, email, cameras, plan and preferences under Settings.
Notification choices — turn individual push, email and SMS notifications on or off under Settings → Notifications.
Export your data — request a machine-readable copy of your account data and a download of your captures from the Exports section.
Manage sharing — revoke share links, remove friends, and leave groups at any time.
Sessions and security — review your active sessions and sign out of any device under Settings → Security.
Delete individual content — delete any capture, trip or camera from your account.
Delete your account — go to Account → Delete account, or open app.wildon.com.au/account/delete. This deletes your account and associated personal information as described in section 11, after a 14-day grace period you can cancel by signing back in. You do not need to contact us or install anything to do this. If you cannot access the app, email support@wildon.com.au from your registered address and we will action it for you.

13.2 By contacting us

Write to support@wildon.com.au to ask us to:

give you access to the personal information we hold about you;
correct information that is inaccurate, out of date, incomplete, irrelevant or misleading;
delete or de-identify information (subject to our legal retention obligations);
provide your information in a portable, machine-readable format, or transmit it to another provider where technically feasible;
restrict or object to a particular use, including any use we base on legitimate interests, and any direct marketing;
withdraw a consent you previously gave, without affecting processing already carried out; or
tell you whether we hold information about you at all, and where we got it.

We will acknowledge your request promptly and respond within 30 days. We may need to verify your identity first, which protects you as much as us. If we refuse a request, we will tell you why in writing and explain how to complain.

13.3 Complaints

If you are unhappy with how we have handled your personal information or a privacy request, tell us first at support@wildon.com.au with “Privacy complaint” in the subject line. We will investigate and respond in writing within 30 days.

If you are not satisfied with our response, you can complain to a regulator:

Australia — Office of the Australian Information Commissioner, oaic.gov.au, GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992.
European Economic Area — your national data protection supervisory authority.
United Kingdom — the Information Commissioner’s Office, ico.org.uk.

14. If you are in the European Economic Area or the United Kingdom

Buynetic Pty Ltd is the controller of your personal data. Our lawful bases are set out in section 5, our international transfer safeguards in section 9, and our retention periods in section 11.

In addition to the rights in section 13, you have the right to lodge a complaint with your supervisory authority, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects — which, as noted in section 6, we do not do.

We do not currently have an establishment in the European Union or the United Kingdom. Where Article 27 of the GDPR requires it, we will appoint a representative and publish their details here.

15. If you are in California or another US state with a privacy law

This section applies to residents of California under the California Consumer Privacy Act as amended by the CPRA, and, as relevant, to residents of other US states with comparable laws.

Categories of personal information we have collected in the last 12 months: identifiers (name, email, account ID, IP address, device identifiers); customer records (billing contact details, payment token); commercial information (subscription, purchase and usage history); internet or network activity (app and site interactions, diagnostic logs); geolocation data (camera and capture locations, and app location where you permit it); visual information (the photos and videos your cameras capture); and inferences drawn from captures (AI-generated species and object labels). The sources, purposes and disclosures for each are described in sections 3, 5, 7 and 8.

We have not sold personal information, and we have not shared personal information for cross-context behavioural advertising, in the preceding 12 months, and we do not do so now. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Sensitive personal information. We collect precise geolocation in the sense described in section 3.5 and account credentials. We use these only to provide the Service and to secure your account — never to infer characteristics about you — so no right to limit their use applies. We do not otherwise collect sensitive personal information.

Your rights to know, access, correct, delete, obtain a portable copy, opt out of sale or sharing, limit the use of sensitive personal information, and be free from discrimination for exercising any of them, are all honoured through the mechanisms in section 13. You may use an authorised agent, in which case we will ask for proof of authorisation.

16. Children

WildOn is not directed to children. You must be at least 16 years old to create a WildOn account, and at least 18 to purchase a subscription or hardware. We do not knowingly collect personal information from anyone under 16 — or, in the United States, from a child under 13 within the meaning of the Children’s Online Privacy Protection Act.

If we learn that we have collected personal information from a child below the applicable age without verified parental consent, we will delete it promptly. If you believe a child has provided us with personal information, contact support@wildon.com.au.

17. Third-party links and services

The Service may link to third-party websites, app stores or services that we do not control. This policy does not apply to them, and we are not responsible for their content or privacy practices. Read their policies before providing them with your information.

18. Changes to this policy

We may update this policy as the Service changes or as the law requires. The version published here is always the current one, and the effective date is shown at the top. If a change is material — for example, a new purpose for using your information, or a new category of recipient — we will give you reasonable advance notice by email, by an in-app notice, or both, before it takes effect, and where the law requires it we will ask for your consent. Continuing to use the Service after a change takes effect means you accept the updated policy.

19. Contact us

Buynetic Pty Ltd (ABN 46 647 898 468), operator of WildOn
Suite 3A16, Level 14, 275 Little Alfred Street
North Sydney NSW 2060, Australia
Email: support@wildon.com.au
Web: www.buynetic.com.au and app.wildon.com.au

We are happy to provide this policy in an alternative accessible format on request.